This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.
We present a method for zero-knowledge, hash-based challenge-response network authentication in lieu of transmitting a password across the network. Zero-knowledge protocols, like our method, offer authentication alternatives to prevent a third-party from discovering a password after intercepting network data. Our method makes use of one-way hash functions to generate a response from a randomly-created challenge code supplied by an identity verier. Our method also makes use of dynamic engagement for choosing which hash functions are used on a per-case basis, in order to thwart reversal of our method in the event of future discovery of weaknesses in any of the deployed hash functions.
Server - generate a chanllenge code and submit the response generated by the Client program.
Client - use ?chal=*challenge number* (generated by the server) in the url to get the correct response code.
SPHiNX was authored by Josh Hollenbeck, Ryan Lewis, and Pat Wilbur.
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.